Reading is different from authorising
Imagine a purchasing assistant comparing supplier documents. One attachment asks the assistant to send its working notes to an unfamiliar address. That sentence is material being reviewed, not approval from the business owner. In this hypothetical workflow, the useful result is a comparison supported by evidence. Sending information elsewhere would require separate authority. Define that distinction before connecting an assistant to email, records or operational tools.
Enforce limits where an action happens
OWASP describes malicious instructions arriving through external documents, webpages and tool content. Its guidance recommends enforcing permissions and validating parameters at the tool boundary. For a proposed purchasing pilot, let the assistant read only the records needed for the comparison. The connected application should reject unapproved destinations and operations even when a model requests them. Labelling a document as untrusted does not enforce those limits. OWASP: LLM Prompt Injection Prevention Cheat Sheet.
Make the proposed action reviewable
Before an external action, our suggested review screen shows the intended operation, recipient, information to be shared and the business request it serves. A reviewer should be able to inspect the actual draft and destination, then accept or reject that specific action. Keep the approved details attached to execution so that a later change requires another review. Do not let text inside a supplier document supply that approval.
Test actions as well as answers
Use synthetic documents containing both ordinary instructions quoted as evidence and attempts to redirect the workflow. Check that legitimate comparisons still finish, while unrelated messages or record changes are blocked. Review the resulting tool calls and business state, alongside the final answer. OWASP recommends testing intended outcomes and reporting evaluation limits. A helpful-looking response alone does not establish that connected actions stayed within scope. OWASP: LLM Prompt Injection Prevention Cheat Sheet.
Recheck the boundary when the workflow changes
Anthropic’s browser-agent research describes improvements from model training, classifiers and testing, while acknowledging that prompt injection remains unresolved. Our recommendation is to retain a small, repeatable evaluation set for each business workflow. Rerun it when models, retrieval sources or tool permissions change. Record failures, unnecessary blocks and recovery decisions. Decide who can pause the workflow and investigate an unexpected action before expanding its responsibilities. Anthropic: Mitigating the risk of prompt injections in browser use.